feat: rate limit

Author: Anonymous961

backend/bun.lock

@@ -1,8 +1,8 @@
 import express, { type NextFunction, type Request, type Response } from "express";
 import cors from "cors"
 import handleFile from "./routes/handleFile";
-// import expressStatusMonitor from 'express-status-monitor';
 import morgan from "morgan";
+import { rateLimit } from "express-rate-limit";
 
 const app = express();
 
@@ -26,6 +26,16 @@ app.use(cors({
     optionsSuccessStatus: 200,
 }));
 
+const limiter = rateLimit({
+    windowMs: 15 * 60 * 1000, // 15 minutes
+    max: isProduction ? 100 : 1000,
+    message: "Too many request from this IP, please try again later",
+    standardHeaders: true,
+    legacyHeaders: false
+})
+
+app.use(limiter);
+
 app.use(express.json({
     limit: '10mb', // Prevent large payload attacks
     verify: (req, res, buf) => {
@@ -42,26 +52,6 @@ app.use(express.urlencoded({ extended: true, limit: '10mb' }));
 app.use(morgan(isProduction ? 'combined' : 'dev', {
     skip: (req, res) => req.path === '/health' // Skip health check logs
 }));
-// if (!isProduction) {
-//     app.use(expressStatusMonitor({
-//         title: 'Candy Share API Status',
-//         path: '/status',
-//         spans: [
-//             { interval: 1, retention: 60 }, // 1 minute intervals, keep 60 datapoints
-//             { interval: 5, retention: 60 },
-//             { interval: 15, retention: 60 }
-//         ],
-//         healthChecks: [
-//             {
-//                 protocol: 'http',
-//                 host: 'localhost',
-//                 path: '/health',
-//                 port: PORT.toString()
-//             }
-//         ],
-//         ignoreStartsWith: '/status' // Don't monitor the status page itself
-//     }));
-// }
 
 app.use((req: Request, res: Response, next: NextFunction) => {
     if (req.path !== '/health') {

backend/index.ts

@@ -28,6 +28,7 @@
     "@types/morgan": "^1.9.10",
     "cors": "^2.8.5",
     "express": "^5.1.0",
+    "express-rate-limit": "^8.0.1",
     "morgan": "^1.10.1"
   }
 }